domenico/openwrt_NSS_ACW
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

netfilter: add iptables-mod-rpfilter package

Browse Source 
Unlike /proc/sys/net/ipv4/conf/INTF/rp_filter flag, rule iptables -t raw
-I PREROUTING -m rpfilter --invert -j DROP prevents conntrack table to
become full when a packet flood with randomly selected source IP addresses
is received from the lan side.

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
This commit is contained in:
Alin Nastac
2017-06-16 14:16:07 +02:00
committed by Hans Dedecker
parent a35a27e8ef
commit d8748e537f
3 changed files with 34 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/netfilter.mk
View File

@@ -106,6 +106,8 @@ $(eval $(call nf_add,IPT_FILTER,CONFIG_NETFILTER_XT_MATCH_STRING, $(P_XT)xt_stri
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_DSCP, $(P_XT)xt_dscp))
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_TARGET_DSCP, $(P_XT)xt_DSCP))
$(eval $(call nf_add,IPT_HASHLIMIT,CONFIG_NETFILTER_XT_MATCH_HASHLIMIT, $(P_XT)xt_hashlimit))
$(eval $(call nf_add,IPT_RPFILTER,CONFIG_IP_NF_MATCH_RPFILTER, $(P_V4)ipt_rpfilter))
$(eval $(call nf_add,IPT_RPFILTER,CONFIG_IP6_NF_MATCH_RPFILTER, $(P_V6)ip6t_rpfilter))
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_LENGTH, $(P_XT)xt_length))
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_STATISTIC, $(P_XT)xt_statistic))
$(eval $(call nf_add,IPT_IPOPT,CONFIG_NETFILTER_XT_MATCH_TCPMSS, $(P_XT)xt_tcpmss))

18
package/kernel/linux/modules/netfilter.mk
View File

@@ -836,6 +836,24 @@ endef
$(eval $(call KernelPackage,ipt-hashlimit))
define KernelPackage/ipt-rpfilter
SUBMENU:=$(NF_MENU)
TITLE:=Netfilter rpfilter match
DEPENDS:=+kmod-ipt-core
KCONFIG:=$(KCONFIG_IPT_RPFILTER)
FILES:=$(realpath \
$(LINUX_DIR)/net/ipv4/netfilter/ipt_rpfilter.ko \
$(LINUX_DIR)/net/ipv6/netfilter/ip6t_rpfilter.ko)
AUTOLOAD:=$(call AutoProbe,ipt_rpfilter ip6t_rpfilter)
$(call KernelPackage/ipt)
endef
define KernelPackage/ipt-rpfilter/description
Kernel modules support for the Netfilter rpfilter match
endef
$(eval $(call KernelPackage,ipt-rpfilter))
define KernelPackage/nft-core
SUBMENU:=$(NF_MENU)

14
package/network/utils/iptables/Makefile
View File

@@ -242,6 +242,19 @@ iptables extensions for hashlimit matching
endef
define Package/iptables-mod-rpfilter
$(call Package/iptables/Module, +kmod-ipt-rpfilter)
TITLE:=rpfilter iptables extension
endef
define Package/iptables-mod-rpfilter/description
iptables extensions for reverse path filter test on a packet
Matches:
- rpfilter
endef
define Package/iptables-mod-iprange
$(call Package/iptables/Module, +kmod-ipt-iprange)
TITLE:=IP range extension
@@ -565,6 +578,7 @@ $(eval $(call BuildPlugin,iptables-mod-cluster,$(IPT_CLUSTER-m)))
$(eval $(call BuildPlugin,iptables-mod-clusterip,$(IPT_CLUSTERIP-m)))
$(eval $(call BuildPlugin,iptables-mod-ulog,$(IPT_ULOG-m)))
$(eval $(call BuildPlugin,iptables-mod-hashlimit,$(IPT_HASHLIMIT-m)))
$(eval $(call BuildPlugin,iptables-mod-rpfilter,$(IPT_RPFILTER-m)))
$(eval $(call BuildPlugin,iptables-mod-led,$(IPT_LED-m)))
$(eval $(call BuildPlugin,iptables-mod-tproxy,$(IPT_TPROXY-m)))
$(eval $(call BuildPlugin,iptables-mod-tee,$(IPT_TEE-m)))